Analysis

  • max time kernel
    138s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2023, 19:51

General

  • Target

    0x0006000000023283-360.exe

  • Size

    221KB

  • MD5

    8d9cc43d358ad0850654f08dbc77bf52

  • SHA1

    d93305e206f0d8c0b68d2be75f3ab029462f71c7

  • SHA256

    f95b625da40dcafd8a9a63f764d85336c71abb2b9f3fad4717d7ad14e6ed50a2

  • SHA512

    36dbc10485e99e49dfa0dc167952ba60d2c14e89a556d176781ea1f011ee145b8e171e69153a867cb046dfd503cbdeabcf943fab50fb37336b847400a78fac15

  • SSDEEP

    3072:yFyOHrnNNgchKkRm8pyUDv8ZTYllt/q0ePfm/lpvSLaeG:yFyOLNNgch5k80UDGYp/mPfmdJSLa

Malware Config

Extracted

Family

redline

Botnet

lutyr

C2

77.91.124.55:19071

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0006000000023283-360.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0006000000023283-360.exe"
    1⤵
      PID:2712

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2712-0-0x0000000000D20000-0x0000000000D5E000-memory.dmp

            Filesize

            248KB

          • memory/2712-1-0x0000000074AD0000-0x0000000075280000-memory.dmp

            Filesize

            7.7MB

          • memory/2712-2-0x00000000080B0000-0x0000000008654000-memory.dmp

            Filesize

            5.6MB

          • memory/2712-3-0x0000000007BE0000-0x0000000007C72000-memory.dmp

            Filesize

            584KB

          • memory/2712-4-0x0000000007D00000-0x0000000007D10000-memory.dmp

            Filesize

            64KB

          • memory/2712-5-0x0000000007C90000-0x0000000007C9A000-memory.dmp

            Filesize

            40KB

          • memory/2712-6-0x0000000008C80000-0x0000000009298000-memory.dmp

            Filesize

            6.1MB

          • memory/2712-7-0x0000000007F90000-0x000000000809A000-memory.dmp

            Filesize

            1.0MB

          • memory/2712-8-0x0000000007E80000-0x0000000007E92000-memory.dmp

            Filesize

            72KB

          • memory/2712-9-0x0000000007EE0000-0x0000000007F1C000-memory.dmp

            Filesize

            240KB

          • memory/2712-10-0x0000000007F20000-0x0000000007F6C000-memory.dmp

            Filesize

            304KB

          • memory/2712-11-0x0000000074AD0000-0x0000000075280000-memory.dmp

            Filesize

            7.7MB

          • memory/2712-12-0x0000000007D00000-0x0000000007D10000-memory.dmp

            Filesize

            64KB